I am very concerned with security of my Google account in case I lose the phone (as in: lose it, have it stolen/robbed, etc.). Right now it seems that whoever grabs my phone will also have full access to mail, calendar etc.
I would be perfectly happy to sync manually and/or have a password prompt every time I try to sync, but I don't see this option.
How can I protect my account? Is screen lock any good? How hard is it to bypass it?
The phone is HTC Desire should it matter.
Instead of entering a password every time you sync or access your mails - which will also be more insecure, because you enter the password often and in public - think about a good screen lock (PIN or Password) and a remote wipe solution.
Changing your Google account password is always a good idea in case of a stolen Android device. According to Oleg Ostroumov comment, the device will stay logged in for ~hour and then request a password.
In addition to what Flow says, and I think this is a superior solution:
Use application-specific passwords
The idea here is that you can create an application-specific password for any non web-based application that needs your Google credentials (think Android phones, mail clients, IM clients, etc.) You create a credential for each purpose and use this instead of your Google password -- this doesn't require special cooperation by third-party application developers. You can keep track of all issued application-specific passwords, and revoke them on a case-by-case basis if necessary. So if your phone is stolen, you can easily revoke access to your Google account and the attacker will no longer be able to log in as you. Please note that some applications might leave behind contact lists and offline email which will still be on the device even if it's not associated with a valid Google account. You'll need a remote wipe application for this purpose.
You can find this on your Google Account settings page. Look for authorizing applications and sites, and take it from there. See also this video from Google about 2-step authorization and application-specific passwords.
While at it, enable 2-step authorization using your Android device for an extra layer of security when you log in from an unknown computer/device.
